Golang crypto/tls: frequent "connection reset by peer" failures in TestVerifyCertificates and other tests on freebsd/amd64

#!watchflakes
default <- pkg == "crypto/tls" && test ~ `^TestVerifyCertificates` && `connection reset by peer` && goos == "freebsd"

The legacy builders freebsd-amd64-13_0 and freebsd-amd64-12_3 are frequently failing with "connection reset by peer":

--- FAIL: TestTLS13OnlyClientHelloCipherSuite (0.00s)
    --- FAIL: TestTLS13OnlyClientHelloCipherSuite/empty (0.00s)
        handshake_test.go:425: failed to call cli.Close: close tcp 127.0.0.1:31660->127.0.0.1:64791: connection reset by peer
FAIL
FAIL    crypto/tls  0.431s

--- FAIL: TestTLS13OnlyClientHelloCipherSuite (0.00s)
    --- FAIL: TestTLS13OnlyClientHelloCipherSuite/empty (0.00s)
        handshake_test.go:425: failed to call cli.Close: close tcp 127.0.0.1:37916->127.0.0.1:34439: connection reset by peer
--- FAIL: TestVerifyCertificates (0.01s)
    --- FAIL: TestVerifyCertificates/TLSv13 (0.00s)
        --- FAIL: TestVerifyCertificates/TLSv13/RequireAndVerifyClientCert (0.01s)
            handshake_test.go:425: failed to call cli.Close: close tcp 127.0.0.1:24047->127.0.0.1:34439: connection reset by peer
FAIL
FAIL    crypto/tls  0.381s

For example, see https://build.golang.org/log/259c9ce4acb3f93875a3adf37010f03a1df21523 and https://build.golang.org/log/c3689aa19c83c931dcc6b89757f258dd3a4856f3.

(A builder for freebsd/amd64 isn't available in LUCI yet, see tracking issues #61094 and #61095.)

CC @golang/freebsd.

Comment From: gabyhelp

Similar Issues

• crypto/tls: TestVerifyHostnameResumed consistently failing in longtest builder #32978
• crypto/tls: high rate of test timeouts on 2022-08-08 #54606
• net/smtp: TestTLSClient failures with "connection reset by peer" on freebsd #19229

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

Comment From: gopherbot

Found new dashboard test flakes for:

#!watchflakes
default <- pkg == "crypto/tls" && test ~ `^TestVerifyCertificates` && `connection reset by peer` && goos == "freebsd"

2024-06-21 21:01 gotip-freebsd-riscv64 go@0af2148f crypto/tls.TestVerifyCertificates/TLSv12/RequestClientCert_with_no_certs (log)

=== RUN TestVerifyCertificates/TLSv12/RequestClientCert_with_no_certs === PAUSE TestVerifyCertificates/TLSv12/RequestClientCert_with_no_certs === CONT TestVerifyCertificates/TLSv12/RequestClientCert_with_no_certs handshake_test.go:425: failed to call cli.Close: close tcp 127.0.0.1:64036->127.0.0.1:33107: connection reset by peer --- FAIL: TestVerifyCertificates/TLSv12/RequestClientCert_with_no_certs (0.02s)

2024-06-25 14:29 gotip-freebsd-riscv64 go@b1fd0475 crypto/tls.TestVerifyCertificates/TLSv12/VerifyClientCertIfGiven_with_certs (log)

=== RUN TestVerifyCertificates/TLSv12/VerifyClientCertIfGiven_with_certs === PAUSE TestVerifyCertificates/TLSv12/VerifyClientCertIfGiven_with_certs === CONT TestVerifyCertificates/TLSv12/VerifyClientCertIfGiven_with_certs handshake_test.go:495: failed to call cli.Close: close tcp 127.0.0.1:65153->127.0.0.1:31884: connection reset by peer --- FAIL: TestVerifyCertificates/TLSv12/VerifyClientCertIfGiven_with_certs (0.26s)

2024-07-01 13:41 gotip-freebsd-riscv64 go@c33144c4 crypto/tls.TestVerifyCertificates/TLSv13/InsecureSkipVerify (log)

=== RUN TestVerifyCertificates/TLSv13/InsecureSkipVerify === PAUSE TestVerifyCertificates/TLSv13/InsecureSkipVerify === CONT TestVerifyCertificates/TLSv13/InsecureSkipVerify handshake_test.go:495: failed to call cli.Close: close tcp 127.0.0.1:23059->127.0.0.1:11489: connection reset by peer --- FAIL: TestVerifyCertificates/TLSv13/InsecureSkipVerify (0.05s)

2024-07-03 13:03 gotip-freebsd-riscv64 go@71f9dbb1 crypto/tls.TestVerifyCertificates/TLSv12/RequestClientCert_with_no_certs (log)

=== RUN TestVerifyCertificates/TLSv12/RequestClientCert_with_no_certs === PAUSE TestVerifyCertificates/TLSv12/RequestClientCert_with_no_certs === CONT TestVerifyCertificates/TLSv12/RequestClientCert_with_no_certs handshake_test.go:495: failed to call cli.Close: close tcp 127.0.0.1:39020->127.0.0.1:43674: connection reset by peer --- FAIL: TestVerifyCertificates/TLSv12/RequestClientCert_with_no_certs (0.04s)

— watchflakes

Comment From: gopherbot

Change https://go.dev/cl/602615 mentions this issue: crypto/tls: fix testHandshake close flakes

Comment From: gopherbot

Change https://go.dev/cl/602635 mentions this issue: [release-branch.go1.23] crypto/tls: fix testHandshake close flakes